feat(config): add GENIUSRUN_FRONTEND_URL, defaulting to PublicBaseURL

Lets the OIDC callback redirect to the frontend's real origin instead of
a relative path resolved against the backend's own origin -- needed for
this project's own supported split-origin local dev setup (frontend on
Vite, backend on geniusrund, bridged by CORS).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/config/config_test.go

@@ -134,6 +134,32 @@ func TestLoad_GarminPythonPathExplicitOverridesDefault(t *testing.T) {
 	}
 }
 
+func TestLoad_FrontendURLDefaultsToPublicBaseURL(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_FRONTEND_URL", "")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.FrontendURL != cfg.PublicBaseURL {
+		t.Errorf("FrontendURL = %q, want it to default to PublicBaseURL %q", cfg.FrontendURL, cfg.PublicBaseURL)
+	}
+}
+
+func TestLoad_FrontendURLExplicitOverridesDefault(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_FRONTEND_URL", "http://localhost:5173/")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.FrontendURL != "http://localhost:5173" {
+		t.Errorf("FrontendURL = %q, want http://localhost:5173 (trailing slash trimmed)", cfg.FrontendURL)
+	}
+}
+
 func TestLoad_CustomRoleAndDuration(t *testing.T) {
 	setRequiredEnv(t)
 	t.Setenv("GENIUSRUN_OIDC_REQUIRED_ROLE", "admin")